CVE-2024-45292: PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
Summary \PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability.
PoC
Example target script:
<?php
require 'vendor/autoload.php';
$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx"); $spreadsheet = $reader->load(DIR . '/book.xlsx');
$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet); print($writer->generateHTMLAll());
Save this file in the same directory: book.xlsx
Open index.php in a web browser and click on both links. The first demonstrates the vulnerability in a regular hyperlink and the second in a HYPERLINK() formula.
Other sources
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. \PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45292?
CVE-2024-45292 is classified as a Cross-Site Scripting vulnerability due to improper handling of "javascript:" URLs.
How do I fix CVE-2024-45292?
To fix CVE-2024-45292, update PhpSpreadsheet to version 2.1.1 or later, or to version 1.29.2.
Which versions of PhpSpreadsheet are affected by CVE-2024-45292?
CVE-2024-45292 affects PhpSpreadsheet versions from 2.0.0 up to, but not including, 2.1.1 and all versions before 1.29.2.
What kind of attacks can be performed using CVE-2024-45292?
CVE-2024-45292 can allow attackers to execute arbitrary JavaScript in the context of the user’s browser, leading to potential data theft or session hijacking.
Is there a known exploit for CVE-2024-45292?
While specific exploit details are not provided, the nature of the Cross-Site Scripting vulnerability implies it can be exploited through constructed hyperlinks.